rust_binderfs.c

  1// SPDX-License-Identifier: GPL-2.0
  2
  3#include <linux/compiler_types.h>
  4#include <linux/errno.h>
  5#include <linux/fs.h>
  6#include <linux/fsnotify.h>
  7#include <linux/gfp.h>
  8#include <linux/idr.h>
  9#include <linux/init.h>
 10#include <linux/ipc_namespace.h>
 11#include <linux/kdev_t.h>
 12#include <linux/kernel.h>
 13#include <linux/list.h>
 14#include <linux/namei.h>
 15#include <linux/magic.h>
 16#include <linux/major.h>
 17#include <linux/miscdevice.h>
 18#include <linux/module.h>
 19#include <linux/mutex.h>
 20#include <linux/mount.h>
 21#include <linux/fs_parser.h>
 22#include <linux/sched.h>
 23#include <linux/seq_file.h>
 24#include <linux/slab.h>
 25#include <linux/spinlock_types.h>
 26#include <linux/stddef.h>
 27#include <linux/string.h>
 28#include <linux/types.h>
 29#include <linux/uaccess.h>
 30#include <linux/user_namespace.h>
 31#include <linux/xarray.h>
 32#include <uapi/asm-generic/errno-base.h>
 33#include <uapi/linux/android/binder.h>
 34#include <uapi/linux/android/binderfs.h>
 35
 36#include "rust_binder.h"
 37#include "rust_binder_internal.h"
 38
 39#define FIRST_INODE 1
 40#define SECOND_INODE 2
 41#define INODE_OFFSET 3
 42#define BINDERFS_MAX_MINOR (1U << MINORBITS)
 43/* Ensure that the initial ipc namespace always has devices available. */
 44#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 45
 46DEFINE_SHOW_ATTRIBUTE(rust_binder_stats);
 47DEFINE_SHOW_ATTRIBUTE(rust_binder_state);
 48DEFINE_SHOW_ATTRIBUTE(rust_binder_transactions);
 49DEFINE_SHOW_ATTRIBUTE(rust_binder_proc);
 50
 51char *rust_binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
 52module_param_named(rust_devices, rust_binder_devices_param, charp, 0444);
 53
 54static dev_t binderfs_dev;
 55static DEFINE_MUTEX(binderfs_minors_mutex);
 56static DEFINE_IDA(binderfs_minors);
 57
 58enum binderfs_param {
 59	Opt_max,
 60	Opt_stats_mode,
 61};
 62
 63enum binderfs_stats_mode {
 64	binderfs_stats_mode_unset,
 65	binderfs_stats_mode_global,
 66};
 67
 68struct binder_features {
 69	bool oneway_spam_detection;
 70	bool extended_error;
 71	bool freeze_notification;
 72};
 73
 74static const struct constant_table binderfs_param_stats[] = {
 75	{ "global", binderfs_stats_mode_global },
 76	{}
 77};
 78
 79static const struct fs_parameter_spec binderfs_fs_parameters[] = {
 80	fsparam_u32("max",	Opt_max),
 81	fsparam_enum("stats",	Opt_stats_mode, binderfs_param_stats),
 82	{}
 83};
 84
 85static struct binder_features binder_features = {
 86	.oneway_spam_detection = true,
 87	.extended_error = true,
 88	.freeze_notification = true,
 89};
 90
 91static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb)
 92{
 93	return sb->s_fs_info;
 94}
 95
 96/**
 97 * binderfs_binder_device_create - allocate inode from super block of a
 98 *                                 binderfs mount
 99 * @ref_inode: inode from wich the super block will be taken
100 * @userp:     buffer to copy information about new device for userspace to
101 * @req:       struct binderfs_device as copied from userspace
102 *
103 * This function allocates a new binder_device and reserves a new minor
104 * number for it.
105 * Minor numbers are limited and tracked globally in binderfs_minors. The
106 * function will stash a struct binder_device for the specific binder
107 * device in i_private of the inode.
108 * It will go on to allocate a new inode from the super block of the
109 * filesystem mount, stash a struct binder_device in its i_private field
110 * and attach a dentry to that inode.
111 *
112 * Return: 0 on success, negative errno on failure
113 */
114static int binderfs_binder_device_create(struct inode *ref_inode,
115					 struct binderfs_device __user *userp,
116					 struct binderfs_device *req)
117{
118	int minor, ret;
119	struct dentry *dentry, *root;
120	struct binder_device *device = NULL;
121	rust_binder_context ctx = NULL;
122	struct inode *inode = NULL;
123	struct super_block *sb = ref_inode->i_sb;
124	struct binderfs_info *info = sb->s_fs_info;
125#if defined(CONFIG_IPC_NS)
126	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
127#else
128	bool use_reserve = true;
129#endif
130
131	/* Reserve new minor number for the new device. */
132	mutex_lock(&binderfs_minors_mutex);
133	if (++info->device_count <= info->mount_opts.max)
134		minor = ida_alloc_max(&binderfs_minors,
135				      use_reserve ? BINDERFS_MAX_MINOR - 1 :
136						    BINDERFS_MAX_MINOR_CAPPED - 1,
137				      GFP_KERNEL);
138	else
139		minor = -ENOSPC;
140	if (minor < 0) {
141		--info->device_count;
142		mutex_unlock(&binderfs_minors_mutex);
143		return minor;
144	}
145	mutex_unlock(&binderfs_minors_mutex);
146
147	ret = -ENOMEM;
148	device = kzalloc(sizeof(*device), GFP_KERNEL);
149	if (!device)
150		goto err;
151
152	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
153
154	ctx = rust_binder_new_context(req->name);
155	if (!ctx)
156		goto err;
157
158	inode = new_inode(sb);
159	if (!inode)
160		goto err;
161
162	inode->i_ino = minor + INODE_OFFSET;
163	simple_inode_init_ts(inode);
164	init_special_inode(inode, S_IFCHR | 0600,
165			   MKDEV(MAJOR(binderfs_dev), minor));
166	inode->i_fop = &rust_binder_fops;
167	inode->i_uid = info->root_uid;
168	inode->i_gid = info->root_gid;
169
170	req->major = MAJOR(binderfs_dev);
171	req->minor = minor;
172	device->ctx = ctx;
173	device->minor = minor;
174
175	if (userp && copy_to_user(userp, req, sizeof(*req))) {
176		ret = -EFAULT;
177		goto err;
178	}
179
180	root = sb->s_root;
181	dentry = simple_start_creating(root, req->name);
182	if (IS_ERR(dentry)) {
183		ret = PTR_ERR(dentry);
184		goto err;
185	}
186
187	inode->i_private = device;
188	d_make_persistent(dentry, inode);
189
190	fsnotify_create(root->d_inode, dentry);
191	simple_done_creating(dentry);
192
193	return 0;
194
195err:
196	kfree(device);
197	rust_binder_remove_context(ctx);
198	mutex_lock(&binderfs_minors_mutex);
199	--info->device_count;
200	ida_free(&binderfs_minors, minor);
201	mutex_unlock(&binderfs_minors_mutex);
202	iput(inode);
203
204	return ret;
205}
206
207/**
208 * binder_ctl_ioctl - handle binder device node allocation requests
209 *
210 * The request handler for the binder-control device. All requests operate on
211 * the binderfs mount the binder-control device resides in:
212 * - BINDER_CTL_ADD
213 *   Allocate a new binder device.
214 *
215 * Return: %0 on success, negative errno on failure.
216 */
217static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
218			     unsigned long arg)
219{
220	int ret = -EINVAL;
221	struct inode *inode = file_inode(file);
222	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
223	struct binderfs_device device_req;
224
225	switch (cmd) {
226	case BINDER_CTL_ADD:
227		ret = copy_from_user(&device_req, device, sizeof(device_req));
228		if (ret) {
229			ret = -EFAULT;
230			break;
231		}
232
233		ret = binderfs_binder_device_create(inode, device, &device_req);
234		break;
235	default:
236		break;
237	}
238
239	return ret;
240}
241
242static void binderfs_evict_inode(struct inode *inode)
243{
244	struct binder_device *device = inode->i_private;
245	struct binderfs_info *info = BINDERFS_SB(inode->i_sb);
246
247	clear_inode(inode);
248
249	if (!S_ISCHR(inode->i_mode) || !device)
250		return;
251
252	mutex_lock(&binderfs_minors_mutex);
253	--info->device_count;
254	ida_free(&binderfs_minors, device->minor);
255	mutex_unlock(&binderfs_minors_mutex);
256
257	/* ctx is null for binder-control, but this function ignores null pointers */
258	rust_binder_remove_context(device->ctx);
259
260	kfree(device);
261}
262
263static int binderfs_fs_context_parse_param(struct fs_context *fc,
264					   struct fs_parameter *param)
265{
266	int opt;
267	struct binderfs_mount_opts *ctx = fc->fs_private;
268	struct fs_parse_result result;
269
270	opt = fs_parse(fc, binderfs_fs_parameters, param, &result);
271	if (opt < 0)
272		return opt;
273
274	switch (opt) {
275	case Opt_max:
276		if (result.uint_32 > BINDERFS_MAX_MINOR)
277			return invalfc(fc, "Bad value for '%s'", param->key);
278
279		ctx->max = result.uint_32;
280		break;
281	case Opt_stats_mode:
282		if (!capable(CAP_SYS_ADMIN))
283			return -EPERM;
284
285		ctx->stats_mode = result.uint_32;
286		break;
287	default:
288		return invalfc(fc, "Unsupported parameter '%s'", param->key);
289	}
290
291	return 0;
292}
293
294static int binderfs_fs_context_reconfigure(struct fs_context *fc)
295{
296	struct binderfs_mount_opts *ctx = fc->fs_private;
297	struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb);
298
299	if (info->mount_opts.stats_mode != ctx->stats_mode)
300		return invalfc(fc, "Binderfs stats mode cannot be changed during a remount");
301
302	info->mount_opts.stats_mode = ctx->stats_mode;
303	info->mount_opts.max = ctx->max;
304	return 0;
305}
306
307static int binderfs_show_options(struct seq_file *seq, struct dentry *root)
308{
309	struct binderfs_info *info = BINDERFS_SB(root->d_sb);
310
311	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
312		seq_printf(seq, ",max=%d", info->mount_opts.max);
313
314	switch (info->mount_opts.stats_mode) {
315	case binderfs_stats_mode_unset:
316		break;
317	case binderfs_stats_mode_global:
318		seq_puts(seq, ",stats=global");
319		break;
320	}
321
322	return 0;
323}
324
325static const struct super_operations binderfs_super_ops = {
326	.evict_inode    = binderfs_evict_inode,
327	.show_options	= binderfs_show_options,
328	.statfs         = simple_statfs,
329};
330
331static inline bool is_binderfs_control_device(const struct dentry *dentry)
332{
333	struct binderfs_info *info = dentry->d_sb->s_fs_info;
334
335	return info->control_dentry == dentry;
336}
337
338static int binderfs_rename(struct mnt_idmap *idmap,
339			   struct inode *old_dir, struct dentry *old_dentry,
340			   struct inode *new_dir, struct dentry *new_dentry,
341			   unsigned int flags)
342{
343	if (is_binderfs_control_device(old_dentry) ||
344	    is_binderfs_control_device(new_dentry))
345		return -EPERM;
346
347	return simple_rename(idmap, old_dir, old_dentry, new_dir,
348			     new_dentry, flags);
349}
350
351static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
352{
353	if (is_binderfs_control_device(dentry))
354		return -EPERM;
355
356	return simple_unlink(dir, dentry);
357}
358
359static const struct file_operations binder_ctl_fops = {
360	.owner		= THIS_MODULE,
361	.open		= nonseekable_open,
362	.unlocked_ioctl	= binder_ctl_ioctl,
363	.compat_ioctl	= binder_ctl_ioctl,
364	.llseek		= noop_llseek,
365};
366
367/**
368 * binderfs_binder_ctl_create - create a new binder-control device
369 * @sb: super block of the binderfs mount
370 *
371 * This function creates a new binder-control device node in the binderfs mount
372 * referred to by @sb.
373 *
374 * Return: 0 on success, negative errno on failure
375 */
376static int binderfs_binder_ctl_create(struct super_block *sb)
377{
378	int minor, ret;
379	struct dentry *dentry;
380	struct binder_device *device;
381	struct inode *inode = NULL;
382	struct dentry *root = sb->s_root;
383	struct binderfs_info *info = sb->s_fs_info;
384#if defined(CONFIG_IPC_NS)
385	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
386#else
387	bool use_reserve = true;
388#endif
389
390	device = kzalloc(sizeof(*device), GFP_KERNEL);
391	if (!device)
392		return -ENOMEM;
393
394	ret = -ENOMEM;
395	inode = new_inode(sb);
396	if (!inode)
397		goto out;
398
399	/* Reserve a new minor number for the new device. */
400	mutex_lock(&binderfs_minors_mutex);
401	minor = ida_alloc_max(&binderfs_minors,
402			      use_reserve ? BINDERFS_MAX_MINOR - 1 :
403					    BINDERFS_MAX_MINOR_CAPPED - 1,
404			      GFP_KERNEL);
405	mutex_unlock(&binderfs_minors_mutex);
406	if (minor < 0) {
407		ret = minor;
408		goto out;
409	}
410
411	inode->i_ino = SECOND_INODE;
412	simple_inode_init_ts(inode);
413	init_special_inode(inode, S_IFCHR | 0600,
414			   MKDEV(MAJOR(binderfs_dev), minor));
415	inode->i_fop = &binder_ctl_fops;
416	inode->i_uid = info->root_uid;
417	inode->i_gid = info->root_gid;
418
419	device->minor = minor;
420	device->ctx = NULL;
421
422	dentry = d_alloc_name(root, "binder-control");
423	if (!dentry)
424		goto out;
425
426	inode->i_private = device;
427	info->control_dentry = dentry;
428	d_make_persistent(dentry, inode);
429	dput(dentry);
430
431	return 0;
432
433out:
434	kfree(device);
435	iput(inode);
436
437	return ret;
438}
439
440static const struct inode_operations binderfs_dir_inode_operations = {
441	.lookup = simple_lookup,
442	.rename = binderfs_rename,
443	.unlink = binderfs_unlink,
444};
445
446static struct inode *binderfs_make_inode(struct super_block *sb, int mode)
447{
448	struct inode *ret;
449
450	ret = new_inode(sb);
451	if (ret) {
452		ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET);
453		ret->i_mode = mode;
454		simple_inode_init_ts(ret);
455	}
456	return ret;
457}
458
459void rust_binderfs_remove_file(struct dentry *dentry)
460{
461	simple_recursive_removal(dentry, NULL);
462}
463
464static struct dentry *rust_binderfs_create_file(struct dentry *parent, const char *name,
465						const struct file_operations *fops,
466						void *data)
467{
468	struct dentry *dentry;
469	struct inode *new_inode;
470
471	new_inode = binderfs_make_inode(parent->d_sb, S_IFREG | 0444);
472	if (!new_inode)
473		return ERR_PTR(-ENOMEM);
474	new_inode->i_fop = fops;
475	new_inode->i_private = data;
476
477	dentry = simple_start_creating(parent, name);
478	if (IS_ERR(dentry)) {
479		iput(new_inode);
480		return dentry;
481	}
482
483	d_make_persistent(dentry, new_inode);
484	fsnotify_create(parent->d_inode, dentry);
485	simple_done_creating(dentry);
486	return dentry;
487}
488
489struct dentry *rust_binderfs_create_proc_file(struct inode *nodp, int pid)
490{
491	struct binderfs_info *info = nodp->i_sb->s_fs_info;
492	struct dentry *dir = info->proc_log_dir;
493	char strbuf[20 + 1];
494	void *data = (void *)(unsigned long) pid;
495
496	if (!dir)
497		return NULL;
498
499	snprintf(strbuf, sizeof(strbuf), "%u", pid);
500	return rust_binderfs_create_file(dir, strbuf, &rust_binder_proc_fops, data);
501}
502
503static struct dentry *binderfs_create_dir(struct dentry *parent,
504					  const char *name)
505{
506	struct dentry *dentry;
507	struct inode *new_inode;
508
509	new_inode = binderfs_make_inode(parent->d_sb, S_IFDIR | 0755);
510	if (!new_inode)
511		return ERR_PTR(-ENOMEM);
512
513	new_inode->i_fop = &simple_dir_operations;
514	new_inode->i_op = &simple_dir_inode_operations;
515
516	dentry = simple_start_creating(parent, name);
517	if (IS_ERR(dentry)) {
518		iput(new_inode);
519		return dentry;
520	}
521
522	inc_nlink(parent->d_inode);
523	set_nlink(new_inode, 2);
524	d_make_persistent(dentry, new_inode);
525	fsnotify_mkdir(parent->d_inode, dentry);
526	simple_done_creating(dentry);
527	return dentry;
528}
529
530static int binder_features_show(struct seq_file *m, void *unused)
531{
532	bool *feature = m->private;
533
534	seq_printf(m, "%d\n", *feature);
535
536	return 0;
537}
538DEFINE_SHOW_ATTRIBUTE(binder_features);
539
540static int init_binder_features(struct super_block *sb)
541{
542	struct dentry *dentry, *dir;
543
544	dir = binderfs_create_dir(sb->s_root, "features");
545	if (IS_ERR(dir))
546		return PTR_ERR(dir);
547
548	dentry = rust_binderfs_create_file(dir, "oneway_spam_detection",
549				      &binder_features_fops,
550				      &binder_features.oneway_spam_detection);
551	if (IS_ERR(dentry))
552		return PTR_ERR(dentry);
553
554	dentry = rust_binderfs_create_file(dir, "extended_error",
555				      &binder_features_fops,
556				      &binder_features.extended_error);
557	if (IS_ERR(dentry))
558		return PTR_ERR(dentry);
559
560	dentry = rust_binderfs_create_file(dir, "freeze_notification",
561				      &binder_features_fops,
562				      &binder_features.freeze_notification);
563	if (IS_ERR(dentry))
564		return PTR_ERR(dentry);
565
566	return 0;
567}
568
569static int init_binder_logs(struct super_block *sb)
570{
571	struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir;
572	struct binderfs_info *info;
573	int ret = 0;
574
575	binder_logs_root_dir = binderfs_create_dir(sb->s_root,
576						   "binder_logs");
577	if (IS_ERR(binder_logs_root_dir)) {
578		ret = PTR_ERR(binder_logs_root_dir);
579		goto out;
580	}
581
582	dentry = rust_binderfs_create_file(binder_logs_root_dir, "stats",
583				      &rust_binder_stats_fops, NULL);
584	if (IS_ERR(dentry)) {
585		ret = PTR_ERR(dentry);
586		goto out;
587	}
588
589	dentry = rust_binderfs_create_file(binder_logs_root_dir, "state",
590				      &rust_binder_state_fops, NULL);
591	if (IS_ERR(dentry)) {
592		ret = PTR_ERR(dentry);
593		goto out;
594	}
595
596	dentry = rust_binderfs_create_file(binder_logs_root_dir, "transactions",
597				      &rust_binder_transactions_fops, NULL);
598	if (IS_ERR(dentry)) {
599		ret = PTR_ERR(dentry);
600		goto out;
601	}
602
603	proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc");
604	if (IS_ERR(proc_log_dir)) {
605		ret = PTR_ERR(proc_log_dir);
606		goto out;
607	}
608	info = sb->s_fs_info;
609	info->proc_log_dir = proc_log_dir;
610
611out:
612	return ret;
613}
614
615static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc)
616{
617	int ret;
618	struct binderfs_info *info;
619	struct binderfs_mount_opts *ctx = fc->fs_private;
620	struct inode *inode = NULL;
621	struct binderfs_device device_info = {};
622	const char *name;
623	size_t len;
624
625	sb->s_blocksize = PAGE_SIZE;
626	sb->s_blocksize_bits = PAGE_SHIFT;
627
628	/*
629	 * The binderfs filesystem can be mounted by userns root in a
630	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
631	 * set in s_iflags to prevent security issues where userns root can
632	 * just create random device nodes via mknod() since it owns the
633	 * filesystem mount. But binderfs does not allow to create any files
634	 * including devices nodes. The only way to create binder devices nodes
635	 * is through the binder-control device which userns root is explicitly
636	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
637	 * necessary and safe.
638	 */
639	sb->s_iflags &= ~SB_I_NODEV;
640	sb->s_iflags |= SB_I_NOEXEC;
641	sb->s_magic = RUST_BINDERFS_SUPER_MAGIC;
642	sb->s_op = &binderfs_super_ops;
643	sb->s_time_gran = 1;
644
645	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
646	if (!sb->s_fs_info)
647		return -ENOMEM;
648	info = sb->s_fs_info;
649
650	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
651
652	info->root_gid = make_kgid(sb->s_user_ns, 0);
653	if (!gid_valid(info->root_gid))
654		info->root_gid = GLOBAL_ROOT_GID;
655	info->root_uid = make_kuid(sb->s_user_ns, 0);
656	if (!uid_valid(info->root_uid))
657		info->root_uid = GLOBAL_ROOT_UID;
658	info->mount_opts.max = ctx->max;
659	info->mount_opts.stats_mode = ctx->stats_mode;
660
661	inode = new_inode(sb);
662	if (!inode)
663		return -ENOMEM;
664
665	inode->i_ino = FIRST_INODE;
666	inode->i_fop = &simple_dir_operations;
667	inode->i_mode = S_IFDIR | 0755;
668	simple_inode_init_ts(inode);
669	inode->i_op = &binderfs_dir_inode_operations;
670	set_nlink(inode, 2);
671
672	sb->s_root = d_make_root(inode);
673	if (!sb->s_root)
674		return -ENOMEM;
675
676	ret = binderfs_binder_ctl_create(sb);
677	if (ret)
678		return ret;
679
680	name = rust_binder_devices_param;
681	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
682		strscpy(device_info.name, name, len + 1);
683		ret = binderfs_binder_device_create(inode, NULL, &device_info);
684		if (ret)
685			return ret;
686		name += len;
687		if (*name == ',')
688			name++;
689	}
690
691	ret = init_binder_features(sb);
692	if (ret)
693		return ret;
694
695	if (info->mount_opts.stats_mode == binderfs_stats_mode_global)
696		return init_binder_logs(sb);
697
698	return 0;
699}
700
701static int binderfs_fs_context_get_tree(struct fs_context *fc)
702{
703	return get_tree_nodev(fc, binderfs_fill_super);
704}
705
706static void binderfs_fs_context_free(struct fs_context *fc)
707{
708	struct binderfs_mount_opts *ctx = fc->fs_private;
709
710	kfree(ctx);
711}
712
713static const struct fs_context_operations binderfs_fs_context_ops = {
714	.free		= binderfs_fs_context_free,
715	.get_tree	= binderfs_fs_context_get_tree,
716	.parse_param	= binderfs_fs_context_parse_param,
717	.reconfigure	= binderfs_fs_context_reconfigure,
718};
719
720static int binderfs_init_fs_context(struct fs_context *fc)
721{
722	struct binderfs_mount_opts *ctx;
723
724	ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL);
725	if (!ctx)
726		return -ENOMEM;
727
728	ctx->max = BINDERFS_MAX_MINOR;
729	ctx->stats_mode = binderfs_stats_mode_unset;
730
731	fc->fs_private = ctx;
732	fc->ops = &binderfs_fs_context_ops;
733
734	return 0;
735}
736
737static void binderfs_kill_super(struct super_block *sb)
738{
739	struct binderfs_info *info = sb->s_fs_info;
740
741	/*
742	 * During inode eviction struct binderfs_info is needed.
743	 * So first wipe the super_block then free struct binderfs_info.
744	 */
745	kill_anon_super(sb);
746
747	if (info && info->ipc_ns)
748		put_ipc_ns(info->ipc_ns);
749
750	kfree(info);
751}
752
753static struct file_system_type binder_fs_type = {
754	.name			= "binder",
755	.init_fs_context	= binderfs_init_fs_context,
756	.parameters		= binderfs_fs_parameters,
757	.kill_sb		= binderfs_kill_super,
758	.fs_flags		= FS_USERNS_MOUNT,
759};
760
761int init_rust_binderfs(void)
762{
763	int ret;
764	const char *name;
765	size_t len;
766
767	/* Verify that the default binderfs device names are valid. */
768	name = rust_binder_devices_param;
769	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
770		if (len > BINDERFS_MAX_NAME)
771			return -E2BIG;
772		name += len;
773		if (*name == ',')
774			name++;
775	}
776
777	/* Allocate new major number for binderfs. */
778	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
779				  "rust_binder");
780	if (ret)
781		return ret;
782
783	ret = register_filesystem(&binder_fs_type);
784	if (ret) {
785		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
786		return ret;
787	}
788
789	return ret;
790}